Users funds can be locked in escrow module due to possibility of feeNumerator being set too high

[c4-bot-6]

Lines of code

https://github.com/re-nft/smart-contracts/blob/3ddd32455a849c3c6dc3c3aad7a33a6c9b44c291/src/policies/Admin.sol#L173

Vulnerability details

The setFee function in the Admin contract allows the admin to set the protocol fee numerator. However, there is no explicit check in the code to ensure that the feeNumerator does not exceed a certain maximum value, which is typically necessary to prevent setting fees that are too high.

function setFee(uint256 feeNumerator) external onlyRole("ADMIN_ADMIN") {
    ESCRW.setFee(feeNumerator);
}

Impact

Without a check on the feeNumerator, an admin could potentially set an excessively high fee, which could be detrimental to the users of the protocol. It could lead to a loss of trust, a decrease in usage, and an overall negative impact on the protocol's reputation and adoption. In the worst case, if the fee is set to 100% or higher, it could effectively lock users' funds within the escrow module.

Mitigations

• Fee Cap: Implement a maximum fee cap within the setFee function to prevent setting the fee higher than a reasonable percentage (e.g., 10%).

function setFee(uint256 feeNumerator) external onlyRole("ADMIN_ADMIN") {
    require(feeNumerator <= 1000, "Admin: Fee cannot exceed 10%");
    ESCRW.setFee(feeNumerator);
}

• Governance Approval: Require that changes to the fee structure be approved through a governance process, such as a DAO vote, to ensure community consensus.

• Fee Change Notification: Implement an event that is emitted when the fee is changed, providing transparency and allowing users to be notified of fee adjustments.

• Time-Lock Mechanism: Introduce a time-lock delay for fee changes to give users time to react and adjust to the new fee structure before it takes effect.

Assessed type

Invalid Validation

[c4-pre-sort]

141345 marked the issue as insufficient quality report

[c4-judge]

0xean marked the issue as unsatisfactory: Insufficient quality